forceu/gokapi · Security
Gokapi has Stored XSS in SVG Hotlinks
- GHSA ID
- GHSA-3c22-5j5m-4jq7
- CVE ID
- CVE-2026-28683
- Severity
- high
- Published
- Updated
- CVSS
- 8.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- CVSS v3
- 8.7 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Description
Summary
If a malicious authenticated user uploads SVG and creates a hotlink for it, they achieve stored XSS.
Details
The hotlinking functionality fails to properly handle scripts included in the SVGs, allowing authenticated attackers with the ability to upload and hotlink file to execute arbitrary JS.
Issue found by aisafe.io
Impact
Authenticated attackers with the ability to upload and hotlink files can execute arbitrary JavaScript.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')